@JimSycurity

I enjoy security, technology, learning, books, & the great outdoors. Trying to be human & kind. Opinions = mine. He/Him/Hän

 Minnesota, USA
github.com/JimSycurity
Joined May 2019
  • Tweets19K
  • Following2K
  • Followers2.6K
1.6KMedia
Replying to @JimSycurity
Ope. Updated my profile to a custom domain. bsky.app/profile/jimsycurity…
900
Recent queries.specterops.io updates: • 70+ queries updated, many updates came from community members - thank you all!❤️ • Deprecated `system_tags` in favor of `:Tag_*` • Improved deployment automation • Improved query sync between BloodHound-source and the library
3
10
785
CVE-2026-34348 exploitation demo from my #BHUSA "Pass-the-Passkey Family of Attacks" talk: WebAuthn assertion from recent YubiKey authentication is extracted from Windows Event Log and replayed against Microsoft Entra ID using Passkey Injector. Whitepaper: specterops.io/passkeys
16
188
27
847
123,925
Jim Sykora retweeted
SpecterOps@SpecterOpsAug 3
ConfigManBearPig 2.0 is out, a full Python rewrite built on OpenHound. Faster, runs on Linux, SOCKS proxy support, better BloodHound pathfinding for SCCM attacks. ➡️ ghst.ly/3RGyETm Catch @_Mayyhem demo-ing it live at #BHUSA Arsenal TOMORROW, Tue 8/4, 5:15pm, Station 6.

ConfigManBearPig 2.0 - Things Are Getting Cereal

ConfigManBearPig 2.0 is a Python tool that collects SCCM data for BloodHound to map and fix Configuration Manager attack paths.

specterops.io
45
3
118
13,286
Everything you need to know about OAuth applications in Azure by @shahardorf , @WEareTROOPERS & I 😀 youtube.com/watch?v=SkFbGwwG… BTW - you can see how happy I look when i speak about the things I love 😌
6
31
162
7,672
Jim Sykora retweeted
Karl@kfosaaenJul 29
Our Troopers 26 talk "Modern Adventures in Azure Privilege Escalation" is now online. Thomas and I have an associated blog and resources in the works, so there will be more from us soon. Thanks again to @WEareTROOPERS. This was a fantastic experience! youtube.com/watch?v=GaOi825d…

TROOPERS26: Modern Adventures in Azure Privilege Escalation

More impressions: / wearetroopers / ernw_itsec https://info...

youtube.com
1
12
35
3,098
Jim Sykora retweeted
Enno Rey@Enno_InsinuatorJun 26
#TROOPERS26 roundtable on Identity moderated by @ericonidentity, with @martinsohndk @al3x_n3ff @MGrafnetter @JsQForKnowledge @pssvdrctry @Thomas_Live in the group
1
3
15
2,258
🔐 #EntraOps × #BloodHound: Attack Path Analysis for #MicrosoftIntune and more! Presented at #TROOPERS26 with @martinsohndk on Tiered Administration in #MicrosoftEntra and Cloud-Managed PAWs. We released #BloodHound OpenGraph for #EntraOps to visualize attack paths. 👇 (1/2)
1
7
1
17
3,001
The famous Cookie Monster Agate Geode was discovered by gemologist Lucas Fassari in Brazil in 2020.
12
191
16
2,183
32,796
I hope to see a few of you at @WEareTROOPERS this week! I'm in Heidelberg and excited about the entire identity track.
3
206
Putting the final touches on my @WEareTROOPERS slide deck for next week. For the first time, I’ll be demoing the decryption of BitLocker drives, DNSSEC keys, and ASP.NET Core secrets using KDS root keys, plus hybrid Golden [gd]MSA attacks. troopers.de/troopers26/talks…
Troopers conference talk title slide

ALT Troopers conference talk title slide

3
10
27
4,578
Jim Sykora retweeted
ar0x
@_ar0x4Jun 13
Releasing Tunnel Vision Toolkit, part of my @x33fcon talk on Microsoft Global Secure Access. Includes BOFs to assist in engagements where you face GSA, plus a rogue client that lets you connect to internal resources from unmanaged devices. github.com/ar0x4/tunnel-visi…

GitHub - ar0x4/tunnel-vision-toolkit

Contribute to ar0x4/tunnel-vision-toolkit development by creating an account on GitHub.

github.com
2
40
1
96
13,104
Jim Sykora retweeted
SpecterOps@SpecterOpsJun 12
ICYMI: @0xr0BIT joined #KnowYourAdversary for a discussion on how scheduled tasks store creds, why they frequently appear during security assessments, & how TaskHound helps operators & defenders visualize these relationships directly within BloodHound. 👀 ghst.ly/4x4qGmU
3
1
9
2,184
This post was published as part of the @SpecterOps "GhostWorks" initiative.. exciting times, can't wait to show what we've been doing \o/ specterops.io/blog/2026/06/0…

Introducing GhostWorks: A Practical AI Initiative from SpecterOps 

No hype. No guessing. SpecterOps built GhostWorks to test frontier AI tools against real identity security problems and document what actually works.

specterops.io
Adam Chester 🏴‍☠️
@_xpn_Jun 10
New blog post is up looking at what GEPA is, and how it can be used for refining prompts for security agents. specterops.io/blog/2026/06/0…

Prompt Engineering for Security Agents: A Measurable Approach with GEPA

Stop hoping your prompt edits helped. GEPA uses Genetic-Pareto selection and scored evaluations to prove it. Real code, real results.

specterops.io
9
32
5,329
Jim Sykora retweeted
SpecterOps@SpecterOpsJun 9
U2U powers UnPAC-the-Hash and chains into Shadow Credentials and ADCS ESC attacks, but most resources skip the “how.” @GrayHatKiller breaks down Kerberos U2U auth from the RFC to Windows’ divergences—and why modern attacks rely on it. ghst.ly/4egy4TT

User-to-User Authentication: Down the Rabbit Hole - Part 1

A deep dive into Kerberos User-to-User (U2U) authentication and the primitives behind UnPAC-the-Hash, ADCS and shadow credentials.

specterops.io
21
39
2,679
Jim Sykora retweeted
Robin Granberg@ipcdollar1Jun 3
Regarding Active Directory permissions, most people assume that a Deny ACE always wins. It doesn't! Windows stops the access check the moment enough rights are granted — any ACE after that point is never evaluated. New post: managedpriv.com/blog/acl-can…

The Deny ACE That Never Fires: Non-Canonical ACL Order in Active Directory

What canonical ACL order is, how Windows evaluates ACEs top-to-bottom, and what happens when you write a non-canonical ACL — including a proof-of-concept where Allow overrides Deny.

managedpriv.com
1
7
19
1,694
Jim Sykora retweeted
Robin Granberg@ipcdollar1May 22
The .NET ActiveDirectorySecurity API was built for helpdesk scripts, not ACL fidelity. If you're using it for backup, migration, or exact cloning — you're going to have a bad time. New post: the 9 design problems you need to know. bit.ly/3Rl635L

The Hidden Traps in ActiveDirectorySecurity Class

Why the .NET ActiveDirectorySecurity API is fundamentally unsuitable for ACL backup, restore, migration, and any tooling that requires bit-perfect fidelity.

managedpriv.com
1
3
18
1,317
Jim Sykora retweeted
SpecterOps@SpecterOpsMay 21
Found a Tailscale API key on an assessment? In their latest research, @KingOfTheNOPs & @Sw4mp_f0x created TailscaleHound to turn your Tailnet into a BloodHound graph to visualize access paths between Azure & Tailscale. Check it out ⤵️ ghst.ly/4nJkgFF

Introducing TailscaleHound: Mapping Tailscale Attack Paths in BloodHound

TailscaleHound is an OpenGraph collector for BloodHound that maps Tailscale users, devices, groups, tags, ACLs, grants, SSH rules, routes, app connectors, services, keys, invites, webhooks, and...

specterops.io
20
56
3,347
Jim Sykora retweeted
r0BIT@0xr0BITMay 11
shipping: WinSSHound maps SSH access in AD as BloodHound paths. because Windows OpenSSH cheerfully ignores your "Deny Logon" GPOs (pre-2025) and on a default sshd_config every Authenticated User in the domain can walk right in. Why? Because Microsoft. github.com/1r0BIT/WinSSHound

GitHub - 1r0BIT/WinSSHound: Windows SSH Misconfiguration Discovery Tool - Map lateral movement...

Windows SSH Misconfiguration Discovery Tool - Map lateral movement paths through misconfigured SSH services in Active Directory environments - 1r0BIT/WinSSHound

github.com
68
1
207
12,570
Jim Sykora retweeted
SpecterOps@SpecterOpsMay 6
In his latest research, @_xpn_ tears apart VS Code Dev Tunnels and finds a C2 framework underneath — REST → WebSocket → SSH → MsgPack RPC, remote exec, file ops. Find the Ouroboros tool and protocol breakdown at the link! 👇 ghst.ly/4mZ4arb
54
158
9,219
Jim Sykora retweeted
TrustedSec
@TrustedSecApr 23
How well do you really understand what's happening inside a #Kerberos exchange? In our latest blog, @codewhisperer84 breaks down the full authentication flow and demonstrates how to interact with every stage using the #Titanis toolset. Read it now! hubs.la/Q04dcFgv0

Kerberos with Titanis

trustedsec.com
3
71
178
12,345
Load more